diff options
| author | Arnaldo Carvalho de Melo <acme@redhat.com> | 2026-06-04 12:56:02 -0300 |
|---|---|---|
| committer | Arnaldo Carvalho de Melo <acme@redhat.com> | 2026-06-04 17:34:52 -0300 |
| commit | 8cbca8a480e15f6326ce94287570993f27a4b2d5 (patch) | |
| tree | c7b39b070cdfc6329e9a8fc47246c4ea2c5f0d81 | |
| parent | 66ea9de60396a4dea5276bc87025884691876c36 (diff) | |
| download | linux-8cbca8a480e15f6326ce94287570993f27a4b2d5.tar.gz linux-8cbca8a480e15f6326ce94287570993f27a4b2d5.zip | |
perf sched: Fix NULL dereference in latency_runtime_event
latency_runtime_event() passes the return value of
machine__findnew_thread() directly to thread_atoms_search() at line
1216, before checking for NULL at line 1220. thread_atoms_search()
calls pid_cmp() which dereferences the thread pointer via
thread__tid(), causing a NULL pointer dereference if the allocation
fails.
All other callers of thread_atoms_search() in this file
(latency_switch_event, latency_wakeup_event,
latency_migrate_task_event) correctly check for NULL first.
Move the atoms assignment after the NULL check to match the pattern
used by the other callers.
Fixes: b91fc39f4ad7 ("perf machine: Protect the machine->threads with a rwlock")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
| -rw-r--r-- | tools/perf/builtin-sched.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c index 13b801496a01..36da451447b5 100644 --- a/tools/perf/builtin-sched.c +++ b/tools/perf/builtin-sched.c @@ -1213,13 +1213,15 @@ static int latency_runtime_event(struct perf_sched *sched, const u32 pid = perf_sample__intval(sample, "pid"); const u64 runtime = perf_sample__intval(sample, "runtime"); struct thread *thread = machine__findnew_thread(machine, -1, pid); - struct work_atoms *atoms = thread_atoms_search(&sched->atom_root, thread, &sched->cmp_pid); + struct work_atoms *atoms; u64 timestamp = sample->time; int cpu = sample->cpu, err = -1; if (thread == NULL) return -1; + atoms = thread_atoms_search(&sched->atom_root, thread, &sched->cmp_pid); + /* perf.data is untrusted input — CPU may be absent or corrupted */ if (cpu >= MAX_CPUS || cpu < 0) { pr_warning("WARNING: at offset %#" PRIx64 ": out-of-bound sample CPU %d, skipping sample\n", |